[WIP] Make master node work

[iaguis]

This adds a working configuration for a master node.

Caveats

• There're some hacks involved (see TODOs)
• The changes to the cloudconfig are applied directly to the vendor directory.
• We add the domain k8s.cluster.giantswarm.io to /etc/hosts pointing to 127.0.0.1 and we use ports 6443 (k8s secure) and 2379 (etcd) instead of 443 because we don't have the ingress controllers set up.

Testing

You need to issue some certificates using certctl with "CN=*.cluster.giantswarm.io" for the apiserver, etcd and calico and put them in a directory to pass them to the operator:

> tree certs
certs
├── apiserver-ca.pem
├── apiserver-crt.pem
├── apiserver-key.pem
├── calico
│   ├── client-ca.pem
│   ├── client-crt.pem
│   └── client-key.pem
└── etcd
    ├── server-ca.pem
    ├── server-crt.pem
    └── server-key.pem

2 directories, 9 files

Then, you can start the test "cluster" (only one master):

$ kubectl create -f examples/cluster-cool.yml

On your host, you can add the IP of the instance to /etc/hosts:

> cat /etc/hosts
#
# /etc/hosts: static lookup table for host names
#

#<ip-address>	<hostname.domain.org>	<hostname>
127.0.0.1	localhost.localdomain	localhost
::1		localhost.localdomain	localhost
XX.XX.XX.XX     k8s.cluster.giantswarm.io

Then you can create a kubeconfig similar to this:

apiVersion: v1
clusters:
- cluster:
    user: iago
    certificate-authority: /path/to/certs/apiserver-ca.pem
    server: https://k8s.cluster.giantswarm.io:6443
  name: operator
contexts:
- context:
    cluster: operator
    user: iago
  name: operator
current-context: operator
kind: Config
preferences: {}
users:
- name: iago
  user:
    client-certificate: /path/to/certs/apiserver-crt.pem
    client-key: /path/to/certs/apiserver-key.pem

After that you should have a working kubectl:

$ kubectl cluster-info
Kubernetes master is running at https://k8s.cluster.giantswarm.io:6443

To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.

Pods can't be scheduled because we need workers for that.

[xh3b4sd]

Cool you made the master access work. How do you want to roll with this? The abstraction issues should at least be tracked in our boards as well as the TODOs and then we should continue working there. How is your roadmap with this?

[xh3b4sd]

decrypt-tls-assets.service is AWS specific, right? This does not work that way when we want to have the cloud config manager being abstracted. The dependency statements probably can be the other way around so that we do not pollute the cloud config.

[iaguis]

Yep, this is just a temporary hack because for some reason my decrypt-tls-assets.service wasn't starting.

It's not the proper way to solve it but I'll look at it tomorrow.

[xh3b4sd]

I am not certain but this is maybe necessary for making the guest clusters created by the KVM operator work. So this should be abstracted then.

[iaguis]

Agreed.

[iaguis]

Cool you made the master access work. How do you want to roll with this? The abstraction issues should at least be tracked in our boards as well as the TODOs and then we should continue working there. How is your roadmap with this?

My plan is:

• Create issues for the abstraction problems
• Try to get rid of some (like the decrypt-assets one mentioned above)
• Try to split changes that make sense and create PRs to k8scloudconfig
• Work on/Help with making the worker nodes work

[xh3b4sd]

Ok cool. I think it would make sense to derive upcoming feature branches for further changes from this branch and merge into here first. Then we see the TODOs missing and do not pollute master. Would that work?

[iaguis]

Ok cool. I think it would make sense to derive upcoming feature branches for further changes from this branch and merge into here first. Then we see the TODOs missing and do not pollute master. Would that work?

That works for me, although keep in mind that most of the changes I make here are in vendor, so they should reach k8scloudconfig or be separated to templates in this repo at some point.

I think deriving workers' cloudconfig changes from this branch makes sense so we can have a branch that has both master and workers.

[nhlfr]

Please don't delete the branch